3

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java and Flash plugins. And judging from the constant security updates, this seems to be correct.

I am therefore wondering whether I could run Firefox (Iceweasel) as a different user from my logged in martin account, such as nobody. Even if Firefox had a critical bug, the worst that could happen to me is that files owned by nobody would be compromised.

Is this actually doable? Would this have any disadvantages? Is it really the bulletproof solution I imagine it to be?

How would a Firefox window owned by nobody access my display?

Is there perhaps a better way to make Firefox more secure (i.e. jail)?

I am using Debian Wheezy and LXDE Desktop environment.

10
  • 2
    Run a VM with linux and a browser on it
    – user36976
    Mar 30, 2014 at 11:15
  • you mean running a VM on my machine? For that I would need virtualization infrastructure on my machine, which would bring new possible security problems. Mar 30, 2014 at 11:27
  • do you run in a seperate X Session? if not be aware that the Browser can still attack other Software and your system via the GUI. And Browsers mostly have LAN and WAN access so another vector. Lastly Dbus and KernelDbus seems a good way to break out the browser (which lookily is providing the attacker with Javascript:). What is the problem you see with virtualization (which seems more isolation than mere user-to-user-acount separation)? Mar 30, 2014 at 17:00
  • 1
    @user2675345 the whole point of blue pill root kit is to run your operating system inside a hypervisor, without you noticing. This is impossible without vt-x (your OS would be ridiculously slow without vt-x enabled) Mar 31, 2014 at 14:23
  • 1
    @Martin Vegter "It is too slow to be effective" is an entirely different point to "it will not work at all". Mar 31, 2014 at 14:30

5 Answers 5

4

AppArmor or SELinux is probably a better solution than running Firefox as a different user.

As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.

1
  • even with AppArmor and SELinux lockdown. If in the same XSession the GUI can be another vector to attack the systen. Also most often it is impossible to avoid IPC like D-Bus being active, which again can be a vector. Lastly the browser runs on the system and can attack services only available from localhost. Just added make aware... LSM might not be enough, yet good Mar 31, 2014 at 21:53
2

Have you thought about using something like Tails? As was suggested above, you could use it with a VM, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox that allow you to run Firefox in a sandbox, as well as other chroot solutions.

1

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default).

The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with the change if userid, the transferral of xauth tokens and setting up the DISPLAY. The ssh tunnel is a bit of an innefficient overhead - the laternative is to learn how to use xauth yourself (hint xhost +localhost is not very secure either).

But you realy should NOT be logging in as root to browse the internet in the first place.

2
1

Yes, it is possible.

You can run Firefox from bash as another user by changing it with su -. (example su - user2). Let's say you have unpacked Firefox to /home/user2..

You then need to allow X to display content run by that user (user2) from user1. Additionally, there are some setup steps and preparation needed.

However, during my experiments and thinking about these topics, running Firefox as another user doesn't really solve anything, and unless you do some additional steps, Firefox will have the default skin and look quite bad.

Throughout all these experiments I've run Firefox on GNU/Linux systems with (varying degrees of) MAC, to lock it down and to analyze what it is doing.

Just to highlight how useless it is to run Firefox with another user, I'm currently running Firefox on a virtual machine on a completely MAC-locked host, with MAC on the guest as well. It is sufficient, but it's not good for things like watching video, since there is no GPU acceleration.

A less intrusive way of making Firefox safe is probably to use a Sandbox and/or container or something like that in combination with MAC.

0

paranoid mode:

  • install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend)
  • run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian)
  • harden this browser with noscript, adblockplus, ghostery, request-policy and cert-checker, no 3rd-party-cookies, etc
  • instead of linux, use bsd, haiku or plan9
12
  • What is the logic behind don't use Linux? It's not that obscure operating systems are more secure. If there are not enough developers to fix bugs or improve security features then it's actually the opposite. Case in point: FreeBSD does not even have ASLR, something Linux has had for over 10 years. Even Microsoft introduced it in Windows Vista. Mar 31, 2014 at 12:57
  • can the x-forwarding still allow attacks? i.e. how does the browser interact with clipboard etc etc? Still I guess its the safest solution yet! Mar 31, 2014 at 13:53
  • > can the x-forwarding still allow attacks? yes, but onbly against that system the browser runs on. clipboard works just fine from linux to linux and might work too with windows and a XServer Mar 31, 2014 at 14:22
  • Installing 3rd party Addons to "harden" my browser is ridiculous. Mar 31, 2014 at 14:31
  • @Martin Vegter Noscript will block Javascript, Java and Flash by default which is how much browser exploits occur in the first place. Mar 31, 2014 at 18:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .